CVE-2024-34055

Vulnerability

Cyrus IMAP server versions before 3.8.3 and 3.10.x before 3.10.0-rc1 contain a memory exhaustion vulnerability in the handling of IMAP LITERALs. The IMAP protocol allows command arguments to be LITERALs of negotiated length; the server allocates memory to receive the content before instructing the client to proceed, and the allocated memory is released only after the entire command has been received and processed. Commands such as SEARCH accept an unlimited number of arguments, each of which can be a LITERAL. By sending a single command with many LITERALs, an authenticated attacker can cause unbounded memory allocation, potentially exhausting server memory [1][2].

Exploitation

An attacker must be authenticated to the Cyrus IMAP server. The attacker sends a single IMAP command (e.g., SEARCH) containing a large number of LITERAL arguments. The server allocates memory for each LITERAL as it is received, and does not release that memory until the entire command is fully processed. By crafting a command with many LITERALs, the attacker can trigger continuous memory allocation, leading to memory exhaustion [1][2].

Impact

Successful exploitation results in denial of service due to memory exhaustion. The server may run out of memory, with consequences depending on the system's out-of-memory (OOM) policy. This can cause the Cyrus IMAP process to crash or become unresponsive, affecting email service availability [1][2].

Mitigation

The vulnerability is fixed in Cyrus IMAP 3.8.3 and 3.10.0-rc1 [1][2]. Two new configuration options in imapd.conf have been introduced to limit resource consumption: maxargssize (default unlimited) limits the overall length of a single IMAP command, and maxliteral (default 128K) limits the length of individual IMAP LITERALs. Deployments should upgrade to the fixed versions and configure these limits according to their system resources and client usage patterns. Note that the APPEND command's message literal is already limited by maxmessagesize, not by these new options [1][2].